You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 11, 2026

Vietnam’s Draft Decree on Non-Cash Payments Would Relax Requirements for IPS Providers

On July 27, 2026, the State Bank of Vietnam (SBV) released a draft decree proposing amendments to Decree No. 52/2024/ND-CP dated May 15, 2024, on non-cash payments (Decree 52). The draft decree would amend 17 of Decree 52’s 38 articles, with several key changes directly affecting providers of intermediary payment service (IPS). The key proposed changes affecting IPS providers are outlined below.

Streamlining IPS Licensing Procedures

A central objective of the draft decree is to simplify regulatory procedures for IPS providers. Notably, it would significantly reduce IPS licensing documentation requirements by removing the need to submit enterprise registration certificates, investment registration certificates, and documents evidencing the qualifications of the legal representative and general director. Instead, the SBV would retrieve this information directly from national business registration and other specialized databases, requesting additional documents only where the relevant information cannot be verified electronically or is incomplete.

The draft decree also removes the current limit of two rounds for dossier supplementation and shortens processing timelines for several IPS licensing procedures such as issuance, amendment, and reissuance of IPS licenses. The processing time for new IPS license applications would be thereby reduced from 90 to 60 working days.

In addition, several continuing IPS business conditions would be removed. For example, IPS providers would no longer be required to maintain certain representations relating to corporate restructuring or the legality of contributed capital. Likewise, the IPS project plan (đề án) would become a one-time application document rather than an ongoing licensing condition. If retained in the final decree, this change could provide IPS providers with significantly greater flexibility to implement post-licensing technology upgrades, system integrations, and corporate restructuring transactions without needing to revisit the originally approved project plan. The draft decree also removes the requirement for the SBV to consult the Ministry of Public Security before approving amendments to an IPS license.

Further, the draft decree clarifies license validity, renewal procedures, and continuing notification obligations, providing greater certainty regarding the lifecycle of IPS licenses.

Operating Conditions for IPS Providers

While reducing licensing burdens, the draft decree also introduces several targeted refinements to the ongoing regulatory framework applicable to IPS providers. The most significant supervisory reform is the introduction of a new partial license revocation mechanism, in contrast to the current framework, which only contemplates revocation of an IPS license as a whole. Under the draft decree, the SBV would be able to revoke one or more specific licensed services where the provider commits violations relating to those services, such as failing to maintain sufficient guarantee account balances for e-wallet services or repeatedly submitting inaccurate reports. This would provide the SBV with a more proportionate enforcement tool while allowing compliant business lines to continue operating.

Before launching services, providers must submit documentation demonstrating that their information system has achieved at least Level 3 security classification. While this requirement already exists under Decree 52, the draft decree clarifies the relevant documentation that must be submitted. In addition, it introduces a new obligation requiring providers to notify the SBV and submit an updated technical description if the technical solution described in their licensing dossier changes before operations commence. According to the SBV, this amendment is intended to align the regulatory framework with existing supervisory practice of reviewing the technical solution ultimately deployed before an IPS is launched.

The draft decree reinforces existing safeguards applicable to e-wallet services by clarifying that IPS providers must maintain guarantee payment accounts whose aggregate balance is at least equal to the total balance of customers’ e-wallets. It also confirms that the linking of e-wallets with customers’ payment accounts and debit cards will continue to be governed by detailed regulations issued by the SBV.

The draft decree also removes the current restriction limiting participants in a financial switching system to connecting with no more than two financial switching service providers. This amendment would provide greater flexibility in connectivity arrangements and payment infrastructure design, including for participants engaging in international financial switching activities.

Expanding Cross-Border IPS Market Access Channels

Beyond administrative simplification, the draft decree introduces several substantive amendments relevant to IPS market access and infrastructure. One notable proposal concerns foreign payment service providers seeking to collaborate with Vietnamese IPS providers. Under the current framework, foreign payment service providers can access the Vietnamese market only through contractual collaboration with commercial banks or foreign bank branches approved by the SBV to participate in the relevant international payment system. The draft decree would expand this framework by also allowing foreign providers to connect through licensed international financial switching service providers established in Vietnam, such as NAPAS, MobiFone, and any future licensed providers. According to the SBV, this amendment is intended to facilitate emerging cross-border payment models, particularly regional QR payment connectivity initiatives.

Taken together, the introduction of a framework for international financial switching services and the removal of the current two-provider connectivity cap could facilitate a more interconnected cross-border payment ecosystem and provide greater flexibility for institutions participating in international payment networks.

Outlook

The draft decree reflects an evolutionary rather than revolutionary approach to reforming Vietnam’s non-cash payment framework. By combining administrative simplification with targeted updates to the legal framework and a more refined supervisory regime, the SBV seeks to reduce regulatory friction for IPS providers while maintaining appropriate oversight. If adopted in its current form, the draft decree should improve legal certainty for IPS providers and support the continued development of Vietnam’s digital payment ecosystem.

IPS providers should review the proposed amendments carefully, particularly those affecting licensing procedures, cross-border payment arrangements, and ongoing operational compliance. Banks that collaborate with IPS providers should also consider the implications for their existing arrangements.

RELATED INSIGHTS​ 

January 9, 2026
Vietnam has taken a decisive step into the global artificial intelligence regulatory landscape with the promulgation of the Law on Artificial Intelligence No. 134/2025/QH15 (AI Law), adopted on December 10, 2025, and effective from March 1, 2026. As one of the earliest comprehensive, standalone AI statutes in Southeast Asia, the AI Law signals Vietnam’s ambition to position itself as both an innovation-friendly and governance-conscious AI market. In doing so, the legislature has also streamlined Vietnam’s AI regulatory architecture. The AI Law repeals most AI-related provisions previously embedded in the Law on Digital Technology Industry No. 71/2025/QH15, consolidating AI governance under a single, unified legal framework. This structural move underscores an intent to provide greater regulatory clarity and coherence for businesses operating across the AI value chain. Against this backdrop, the key question for AI developers, providers, deployers, and governance teams is how the new risk-based framework will shape compliance expectations, operational decisions, and governance design in practice. This article examines the new AI Law through that practical lens, focusing on what it means for AI businesses operating in or into Vietnam. Scope of Application The AI Law applies broadly to Vietnamese organizations and individuals, as well as foreign entities that participate in AI-related activities within Vietnam. The law expressly excludes AI activities conducted solely for national defense, security, and cryptography purposes. A defining feature of the AI Law is that it regulates by role, not by industry. It distinguishes between: Developers, who design, build, train, test, or fine-tune AI models and have direct control over the technical methods, training data, or model parameters; Providers, who place AI systems on the market or put them into use under their own names; Deployers, who use AI systems under their control in professional, commercial, or service-provision activities; Users, who interact with AI
January 9, 2026
Thailand continues to advance its legal and regulatory framework for the technology sector, with several key laws undergoing review and proposed amendments. These developments reflect Thailand’s broader efforts to ensure that its regulatory landscape keeps pace with rapid technological change and aligns more closely with international standards and best practices. The following are key legal developments and proposed legislative reforms in 2026 that are expected to impact businesses operating in the technology sector and the broader Thai business landscape. Data Privacy and Cybersecurity Personal Data Protection Act B.E. 2562 (2019) Following the full enforcement of Thailand’s Personal Data Protection Act (PDPA) in June 2022, businesses and practitioners have identified practical implementation challenges and interpretative issues. These challenges were reflected in an effectiveness assessment conducted by the Personal Data Protection Committee (PDPC) in late 2024. The PDPC published a set of principles for public consultation to identify issues and directions for potential amendments to the PDPA. Key issues: Emerging issues include clarifying the definitions of “data controller,” “data processor,” and “criminal record”; revisiting the scope of sensitive personal data to better reflect Thailand’s context; proposing amendments to the hierarchy of legal bases to avoid misconceptions of consent as the default legal basis; and clarifying the required level of expressiveness for explicit consent, as well as rules for collecting personal data from other sources. Current status: The first round of public consultation has concluded. Next steps: The proposed amendments are proceeding to a revised draft following the consultation outcomes. Cybersecurity Act B.E. 2562 (2019) Thailand is moving forward with proposed amendments to enhance the effectiveness of its national cybersecurity framework, as evolving digital technologies bring new risks such as misinformation, system intrusions, and attacks on critical infrastructure, making cybersecurity a national priority. Key issues: The amendments aim to clarify and strengthen
January 8, 2026
Thailand’s Digital Government Development Agency (DGA) has proposed new standards that would require government agencies to select cloud services exclusively from a preapproved shortlist of providers. The draft Digital Government Standards re: Cloud Service Provider Standards aims to strengthen procurement confidence and reduce risks associated with selecting cloud service providers that do not meet the required standards. A public hearing period on these standards concluded on December 27, 2025. The DGA will now review submitted comments and consider revising the standards accordingly. Shortlisted Cloud Service Provider Tiers The draft standards establish three tiers of cloud service providers based on their assessed service capability levels, core qualifications, and certifications. The DGA sets qualification requirements for each tier, and it is at the discretion of each agency to select the tier of cloud service provider that best suits its operational needs, as follows: Tier 1 cloud service providers are suitable for providing services involving disclosable official data. Tier 2 cloud service providers are suitable for handling official data and protected data, such as personal data, which requires a high-security public cloud (e.g., virtual private cloud). Tier 3 cloud service providers are suitable for providing services to agencies with specific regulatory and security requirements that handle highly protected data, such as the national security system. These providers must offer sovereign or hybrid cloud as stipulated by the Ministry of Digital Economy and Society. All tiers of cloud service providers must be legal entities incorporated under Thai law and can be authorized distributors of offshore cloud service providers. However, each tier will be subject to different requirements, including infrastructure obligations. Government agencies are encouraged to select a cloud service provider appropriate for their intended use. For example, if a government agency intends to procure cloud services for operating applications that process personal data,
January 8, 2026
Thailand has enacted comprehensive sexual harassment legislation that significantly expands criminal penalties and creates new compliance obligations for online platform operators. The Act Amending the Penal Code (No. 30) B.E. 2568 (2025), enacted on December 29, 2025, and taking effect the following day, introduces a comprehensive definition of sexual harassment, establishes new criminal offenses with graduated penalties, and imposes content removal obligations on social media platforms and computer system service providers. The amendment, which establishes a comprehensive framework for addressing sexual harassment in both physical and digital environments, significantly expands legal exposure for online service operators. It also grants courts authority to order takedowns of violating data accessible to the public. Definition of Sexual Harassment The law introduces “sexual harassment” as a distinct statutory concept covering physical conduct, verbal conduct, sounds, gestures, expressions, postures, communications, surveillance, stalking, and acts committed through computer systems or electronic devices. Conduct qualifies as sexual harassment when it is sexual in nature and likely to cause the victim distress, annoyance, embarrassment, humiliation, fear, or a sense of sexual insecurity. Criminal Offenses and Penalties The amended Penal Code establishes graduated penalties based on the severity and context of the harassment—including enhanced penalties for public or online conduct. For instance: Basic sexual harassment is punishable by imprisonment for up to one year, a fine of up to THB 20,000, or both. Continuous or repeated harassment that prevents normal life escalates penalties to imprisonment for up to two years, a fine of up to THB 40,000, or both. Critically for online operators, harassment committed in public places, in the presence of the public, or through computer systems accessible to the general public triggers imprisonment for up to three years, a fine of up to THB 60,000, or both. Acts of harassment committed by supervisors, employers, or others